Spaghettifying DRAM: remapping memory below the protection boundary
Christopher Domas’s research shows how flipping an exposed DRAM-controller address-swizzle bit on tested AMD Family 16h hardware can create aliases to protected DRAM regions. A GF(2)/Z3 solver recovers the translation, allowing the project to inspect areas such as PSP, SMM, and C6 state that normal physical-address protections assume are unreachable.
This is a low-level research demonstration, not a general remote exploit: it needs root-level hardware-register access, and the published implementation targets an older AMD family; newer CPUs and VM escape are not established. The research matters because security boundaries above the memory controller all depend on that final address mapping. HN readers debated modern-hardware scope and the threat model, while many praised the hardware reverse engineering.